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(57) Abstract: The invention relates to a method of storing data on a rewritable data storage medium, to a corresponding storage 
medium, to a corresponding recording apparatus and to a corresponding playback apparatus. Copy-proleciivc measures require that 
on rewritable storage media some data must be stored which shall not be modifiable or erasable by consumer end products. A 
practical problem is the storage of large quantities of such data in a fixed data area. Typically the capacity is limited to a few bits. 
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S f,xed data area - Tne invention therefore proposes to write the copy protection data as system data in the recordable data area (4), 
e.g. as part of the formatting of the medium (I ). A cryptographic summary is computed and also stored in the recordable data area 
© (32) or in the fixed data area (2) such that a cryptographic relationship between the fixed data area (2) and the system data area (3) is 
^ provided. A playback or replay apparatus will only accept a storage medium with a valid combination of copy protection data and 
fixed data. 
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h'or two-letter codes and oilier abbreviations, refer to the "Guid- 
ance Notes on Codes and Abbreviations" appearing at the begin- 
ning of each regular issue of the PCI' Gazette. 
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Recordable storage medium with protected data area 



The invention relates to a method of storing data on a rewritale data storage 
medium, to a storage medium, to a recording apparatus for storing data on a rewritable data 
storage medium and to a playback apparatus for playback of user data stored on a rewritable 
data storage medium. 

5 The invention addresses a storage medium on which users can store 

copyrighted and copy-free material. Often the user has a right to store and copy content, but 
there are restrictions to the number of (generations of) copies that he can make. Encryption is 
used to ensure that copy-righted content can only be interpreted by "compliant" devices 
which adhere to copy protective restrictions. A further protection is needed to avoid that non- 
10 compliant devices can make a bitwise copy of encrypted data. This is often avoided by 
storing essential information, e.g. a decryption key, in a manner that can not be copied. 

More generally it is concluded that copy-protective measures require that on 
recordable discs some data must be stored which shall not be modifiable or erasable by 
consumer end products. These data will be called "system data" in the following. Examples 
15 of "system data" are: 

a unique disc identifier number which is used to encrypt the data that the user 
stores on the disc, 

a list consisting of a single key which has been encrypted with a number of 
differeiu manufacturer-specific or device-specific keys, 

20 a list of electronic serial numbers of revoked devices or revoked discs. By 

storing such a list on all blank discs, revocation instructions can be disseminated to consumer 
devices. Upon receipt of such revocation instructions, compliant devices refuse to 
communicate with revoked devices. 

Content or data recorded by the user will be called "user data" in the 

25 following. Moreover, the term "fixed data area" will be used for an area of the storage 

medium in which any information is stored that is read-only and not modifiable by consumer 
dffvitTfr . On the* gQ i ntraryj in th® "r»oordablo data oroa" information io otorod whioh oon bo 
modified by consumer devices. Also data, which can only be written by consumer devices 
after some modifications ("hacks") have been made to the device by malicious users will be 
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stored in the recordable data area. Such modifications can be a change in the firmware or 
software used to control the recorder. 

To store data in the fixed data area requires the use of components which are 
typically not available in consumer devices. An example of a technique to store such data is a 
5 . "wobble", which is a radial deviation of the pit positions or the pregroove from a perfect 
. . spiral. Laws of physics and mechanics prohibit that such a wobble can be written on the fly 

by a laser as available in a consumer recorder for optical discs. Other examples of data stored 
< in the fixed data area are the 3CA code, proposed for DVD-ROM, selectively damaged spots 
> .7. - on the disc material burned by high power lasers, or data stored in a specials 
10, which contains read-only material. 

A practical problem Is tiie storage of large quantities of data in the fixed data 
area. Typically the capacity is limited to a few (hundreds of) ; bits. Meanwhile the amount of 
. ^ system data that needs to be stored may well exceed the storage capacity available in the 
fixed data area. 

1 5 The invention has therefore for its object to provide a method of storing data 

on a rewritable data storage medium according to which the above mentioned problems are 
overcome and which allows the storage of large quantities of system data in a tamper- 
resistant manner. Further, a corresponding storage medium, a corresponding recording 
apparatus and a corresponding playback apparatus shall be provided. 

20 These objects are achieved according to the invention by a method as set forth 

in claim 1 or 2, by a storage medium as set forth in claim 9 or 10, by a recording apparatus as 
set forth in claim 12 or 13 and by a playback apparatus as set forth in claim 14 or 15. 

The invention is maiiily based on the idea that there exists some cryptographic 
relationship between data stored in the fixed data area and system data. This relationship is 

25 made up by the cryptographic summary which is according to the invention generated from 
the system data alone or from both the system data and identification data which can be a 
random number stored in the fixed data area. This cryptographic summary is used by a 
recording or playback apparatus to detect whether the system data have been tampered with, 
e.g. erased or modified in order to manipulate the copy proctection of the storage medium. 

30 The cryptographic summary is thus used for verification of the system data which means that 
in case of a verification failure playback or recording of the content of the storage medium 

According to a first solution the system data are written in the recordable data 
area, e.g. as part of the formatting of the storage medium. A cryptographic summary, e.g. a 
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cryptographic hash, is computed over the system data, and the result of that cryptographic 
summary, e.g. the result of that hash, is stored in the fixed data area. A recording apparatus 
will then only accept a storage medium with a valid combination of system data and fixed 
data, i.e. cryptographic summary. 
5 According to an alternative solution identification data, e.g. a random number, 

are created and stored in the fixed data area. The recordable data area then contains the user 
data, the system data and a cryptographic summary of the system.data and the identification 
data, e.g. an electronic signature thereof. A recording or playback apparatus will then use a 
verifier (e.g. a public key) to check the validity of the cryptographic summary, the system 

10 data and the identification data, i.e. the validity of the, signature .will be. checked. Instead of 

using an electronic; signature a message authentication code (MAC) can be used for the 
^ verification which is cheaper but less seciire. : , -.-•■/ > < 

* : . Other preferred embodiments of the invention are disclosed in the dependent 
claims. .. . 

15 . • v : . . , . ■': - y - , . 

The invention and preferred embodiments thereof are explained hereinafter in 
more detail with reference to the following drawings in which 

Fig. 1 shows a recording method according to a first embodiment, 
20 . Fig. 2 shows a playback method according to a first embodiment, 

Fig. 3 shows a recording method according to a second embodiment, 
. Fig. 4 shows a playba.ck method according to the second embodiment, 
Fig. 5 shows, a recording method according to a third embodiment and 
Fig. 6 shows a playback method according to the third embodiment. 

. Figure 1 shows a diagram explaining the method of storing data on a 
rewritable data storage medium according to a first embodiment of the invention. The storage 
.. medium 1 , which can be a disc for optical recording of data, e.g. at DVD or a CD, is 
30 separated into a read-only fixed data area 2 and a recordable data area 3, 4 which is 

subdivided into a system data area 3 and a user data area 4. Data stored in the fixed data area 

pressing of pits into a rewritable disc, i.e. part of the rewritable disc is used as a CD-ROM or 
DVD-ROM medium. Another implementation is the BCA (Burst Cut Area), a barcode 
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pattern at the very inner radius of the disc, written by a YAG laser in the disc-factory. A third 
implementation is to store the fixed data in the radial displacement of the prepressed pits 
( M pit-wobble M ) or the radial displacement of the pre-groove ( ,! pre-groove wobble"). 

Data stored in the recordable data area 3, 4 can be modified by a consumer. 
.5 Nevertheless, the system data area is reserved for system data like copy protection informa- 
tion as outlined at the beginning. The largest part 4 of the recordable data area can be used 
for a storing, user data, e.g. audio or video data. . 
. Since the capacity of the fixed data 2 area is limited, but a growing amount of 

system data shall be stored but shall not be modifiable, the invention proposes to store the 
10, system data in the recordable data area 3 and to install a cryptographic relationship between 
the system data and a specific information: stored in the fixed data area 2 which can not be 
modified during subsequent recording or replay. Therefore a cryptographic summary of the 
■ . system -data is computed by the genera-ting meanis 5, which compute a hash of the system 
data in this embodiment. The cryptographically secure result of that hash is then stored in the 
15/ fixed data area 2. ^ • W 

The method described in Fig. 1 is preferably implemented on a recording 
apparatus for storing the system data and the cryptographic summary on an- empty medium 
using the same or separate recording means. 

In the playback apparatus as shown in figure 2 a hash of the system data stored 
20 in the system data area 3 is computed by similar generating means 5 contained in the 

playback apparatus. The result of that computation is forwarded to verifying meians 6 in the 
playback apparatus which also receive the cryptographic summary read from the fixed data 
area 2 of the medium 1 If this cryptographic summary equals the result of the hash 
computation the verification is successfull and the playback of user data can start or continue 
25 whereas after a verification failure the playback can be stopped since the probabilty is high 
that the system data have been manipulated. Reading means for reading the system data and 
the cryptographic summary from the medium are not shown. 

In apratical realization the medium 1 can be imagined as an (at first empty) 
DVD-RAM or a CD-RW or some other rewritable medium which is sold and contains a list 
30 of serial-numbers of known pirated recorders, hereafter referred to as 'naughty' recorders 

already, written in the disc factory. The list is used by honest players of DVD-RAM/CD-RW 
ofl ' tho otho? »odia4(>^ P3 ifa^^ they 
have been known to be involved in illegal copying. Such a list is usually too long (typically 
more than one MB) to store in a fixed data area (typically a few hundreds of bits). Therefore 
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the list is written like a normal file on the rewritable medium in the factory. To prevent that 
anybody just erases or modifies this list, the hash of this list is computed. This hash is much 
shorter than the system data and can therefore easily be written into the fixed data area during 
the production of the medium. The honest player then would first, upon insertion of the 
5 medium, compute the hash of the system data and check the result with the hash stored in the 
fixed data area. If they don't match, the system data has been tampered with. 

In this basic form no cryptographic secret (e.g. a cryptographic key) has to be 
used anywhere in the system. A disadvantage is, however, the lack of flexibility. This means 
. that the actual bit-content- of the fixed datai arda on the rewritableinedium is fixed forever at 

.10 . the time of the production of the disc in the: facto 

system data that shall be protected prior to; production of the disc. If the system data shall be 
changed, e.g. by adding more naughty recorders to the list, theihash necessarily also changes. 
New media then* have to be produced by the factory; because the old ones no longer have the 
correct hash for the new system data. There 3 are also other reasons why the system data shall 

15 be changed or updated at a time after the production of the disc and fixing of the hash. 

More flexibility is achieved in v a second embodiment of the invention as shown 
in figures 3 and 4. According to this embodiment identification data, e.g.. a random number, 
is stored in the fixed data area during production of the medium. The system data area is 
subdivided into : a' first area 3 1 for the actual system data and a second area 32 for storing a 

20 cryptographic summary. This cryptographic summary is generated by using a public key 
signature algorithm computed in the generating means 7. Therein a-digital signature of the 
identification data and the system data which are at first hash-rcoded by the generating means 
5 is computed using a secret private key Kprivate. This computation can also be written as 
ED = E (hash (system data, : identification data), private key) 

25 wherein ED means extra data (=cryptographic summary) and E means the public-key 

encryption. The computed digital signature is?then stored as cryptographic summary in the 
second system data area 32. - - , 

In a replay apparatus or a recording apparatus as shown in figure 4 the system 
data are verified by at first computing the hash over the identification data and the system 

30 data and then using the public key signature verification algorithm in verifying means 8 and 
the public key Kpubiic to check the validity of the signature stored in the data area 32. The 
privafr Vry nsrd for prnrhirmp thfr digital f ignaftwrif in figma ^nuofr^lc e pforarosgtj wfailo tfao 
public key used for verification in the playback or the recording apparutus as shown in figure 



BNSDOCID: < WO 0 1 95327 A2_ I _ > 



WO 01/95327 PCT/EP0I/05I95 * 

6 

4 can be distributed freely, because this public key is useless in the encryption step as 
, described in figure 3. 

A third embodiment is explained with reference to figures 5 and 6. As in the 
second embodiment identification data are stored in a fixed data area 2 and the actual system 
5 data are stored in a system data area 31 . For encryption the cryptographic summary which 
shall be stored in the system data area 32 is generated by the generating means 9 from the 
( , . ; identification data and the system data using a message authentication code algorithm (MAC 
r ; algorithm) and a secret MAC key. This MAC-encryption can be in short written as 

ED. - E (system data, fixed .data, MAC-key) 
1 0 wherein ED means extra data (^cryptographic summary) and E means MAC-encrypdon. 

In the recording or playback apparatus as shown in figure 6 corresponding 
generating means 9 are provided for computing the massage authentication code from the 
identification data and the system data tising the same secret MAC-key . The computed MAC 
: . is compared in a, verifying means 6 with the cryptographic summary (the MAC) stored in the 
J-.5. ; system, data area 32 for yerification reasons. ■ : J , ^ 

Compared to the second embodiment shown in figures 3 and 4 the use of the 
MAC is less secure than the use of the public-key signature. The key used to compute the 
MAC is present in every playback apparatus in the system, if someone breaks open any 
single player and gets hold of the key, this person can go ahead and replace the system data 
20 by other system data that still certify the MAC in the fixed data area. In contrast, in the 

public-key system of the second embodiment a secret private key is used in the encryption 
process whereas a published public key is used for verification. 

By use of the invention it can be prevented that system data are manipulated. 
By storing special data in the fixed data area malevolent recorders can be prevented from 
25 copying old valid system data to new media, e.g. to replace a new large list of naughty 

recorders by an old short one. Since the system data itself are stored in the recordable data 
area the problem of limited capacity of the fixed data area is overcome. 

Typically system data is stored or hidden in an area that is inaccessible to the 
user, or an area of the medium, where it doesn't interfere with the usual purpose of the disc, i. 
30 e. with user data storage. For DVD and CD media an example would be the so-called lead-in 1 
and 'lead-out 1 areas of the disc. Hereafter such areas will collectively be referred to as 'corner 
flarfrffl'u This hag thig ftd vantage that it doesn't bother tho uoor, and it Gtloo - goneiFCiMy - mQlcoo tfao 
production process much cheaper since comer areas can be stamped very fast, whereas 
recordable data have to be recorded at normal speed. In general players are much cheaper and 
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simpler than recorders, so it is a relatively larger burden to players than to recorders to read 
out the system data in the corner area of the medium. So it makes sense to have the recorder, 
upon first use of the medium, read out the system data and copy its information to the main 
user data area in the recordable data area. The player can then just find the system data 
5 information in the main user data area which it can read anyway. A problem is that the player 
can not trust the recorder since the latter might not faithfully copy the system data. If, 
however, as according to the first embodiment of the invention a hash of the system data is 
stored in the fixed data area, the player can then verify that the incarnation of the system data 
in the main user data area agrees with the hash in the fixed data area. The recorder obviously 
10 can then not have manipulated the fixed data area/ •* 

. : . It shall be noted* that . everytime any detail of the- invention is described with 

. reference to a playback apparatus the playback apparatus can be substituted by a recording 
: apparatus. Both may comprise appropriate reading and/or recdrdihg means for reading and/or 
recording of data from or to the medium. Further, it shall be understood that the storage 
1 5 medium, the recording apparatus and the playback apparatus as set forth in the claims can be 
developed further in the same or a corresponding way as described above and as set forth in 
the subclaims with reference to the method of storing data.- v 
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CLAIMS:. 



5195 ^ 



1 . Method of storing data on a rewritable data storage medium comprising a 
rbad-orily fixed data area and a recordable data area wherein: 

- system data are stored in the recordable data area, 

- a cryptographic summary of the sy stem data is generated and stored in the fixed data area 
5 and 

- the cryptographic summary is used for verification of the system data before reading and/or 
recording of user data! 

2. Method of storing data on a rewritable data storage medium comprising a 
1 0 read-only fixed data area and a recordable data area wherein: 

- system data are stored in the recordable data area, 

- identification data are stored in the fixed data area, 

- a cryptographic summary of the system data and the identification data is generated and 
stored in the recordable data area and 

15 - the cryptographic summary is used for verification of the system data before reading and/or 
recording of user data. 

3 • Method as set forth in claim 1 or 2, characterized in that a hash function is 

used for generating the cryptographic summary and for verifying the system data. 

20 ' : • " ' ' ' ' * 

4. Method as set forth in claim 1 or 2, characterized in that a message 

authentication code algorithm is used for generating the cryptographic summary and for 
verifying the system data. 

25 5. Method as set forth in claim 1 or 2, characterized in that a key signature 

algorithm is used for generating the cryptographic summary and for verifying the system data 
and that a signature is stored as cryptographic summary. 
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6. Method as set forth in claim 1 or 2, characterized in that the cryptographic 

summary is generated and the system data are stored in the recordable data area as part of the 
formatting of the storage medium. 



5 7. Method as set forth in claim 1 or 2, characterized in that copy protection 

information is stored as system data, in particular a unique storage medium identifier, a key 
encrypted by one or more different manufacturer-specific or device-specific keys or one or 
more lists of revoked devices or revoked storage mediums. 

10 8. Method as set forth in claim 1 or 2,. characterized in that the system data is 

originally stored in a corner area of the recordable data area and that during first use of the 
storage medium in a recording apparatus the system data are copied to a user data area of the 
recordable data area. „ 

15 9. Storage medium for storing data comprising 

- a recordable data area in which system data are stored, 

- a read-only fixed data area in which a cryptographic summary of the system data is stored, 
the cryptographic summary being provided for verification of the system data before reading 
and/or recording of user data. 

20 

1 0. Storage medium for storing data comprising 

- a read-only fixed data area in which identification data are stored, 

- a recordable data area in which system data and a cryptographic summary of the system 
data and the identification data are stored, the cryptographic summary being provided for 

25 verification of the system data before reading and/or recording of user data. 

1 1 . Storage medium as set forth in claim 9 or 1 0, characterized in that the storage 
medium is a rewritable optical storage medium, in particular a CD or a DVD. 

30 12. Recording apparatus for storing data on a rewritable data storage medium 

comprising 

- recording means for storing the system data in a recordable data area of the medium and for 
storing the cryptographic summary in a read-only fixed data area of the medium, the 
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cryptographic summary being provided for verification of the system data before reading 
and/or recording of user data. 



13. Recording apparatus for storing data on a rewritable data storage medium 
5 comprising 

- generating means for generating identification data and a cryptographic summary of system 
data and the identification data and 

- recording means for storing the cryptographic summary and the system data in a recordable 
data area of the medium and for storing the identification data in a read-only fixed data area 

10 of the medium, the cryptographic summary being provided for verification of the system data 
before reading and/or recprding of user data. 

1 4. Playback apparatus for playback of user data stored on a rewritable data 
storage medium comprising 

15 - reading means for reading system data stored in the recordable data area of the medium and 
for reading a cryptographic summary of the; system data stored in a read-only fixed data area 
of the medium and 

- verifying means for generating a cryptographic summary of the system data read from the 
medium and for verification of the system data by use of the generated cryptographic 

20 summary. . 

1 5. Playback apparatus for playback of user data stored on a rewritable data 
storage medium comprising 

- reading means for reading identification data from a read-only fixed data area of the 

25 medium and for reading system data and a ayptographic summary of the system data and the 
identification data from a recordable data area of the medium and 

- verifying means for generating a cryptographic summary of the system data and the 
identification data read from the medium and for verification of the system data by use of the 
generated cryptographic summary. 
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